How to write an output module¶
Create file and class¶
- Plugin file in plaso/output/
- Create an empty subclass of plaso.output.interface.OutputModule
- Register it with the output module manager by calling OutputManager.RegisterOutput
- Test file in tests/output/
- Create an empty subclass of tests.output.test_lib.OutputModuleTestCase
Write minimal tests¶
- Write a test that loads your output module.
- It will fail initially, but running the test while you’re developing your plugin gives you a quick way to see if your code is doing what you expect.
Develop plugin¶
- Implement your subclass of plaso.output.interface.OutputModule
- You’ll need to define/overwrite:
- NAME
- DESCRIPTION
- WriteEventBody
- You may also want to override:
- Open()
- Close()
- GetMissingArguments()
- WriteHeader()
- WriteEventStart()
- WriteEventEnd()
- WriteEventMACBGroup()
- WriteFooter()
Expand tests¶
- Add additional tests that test your plugin
Register classes¶
- Edit plaso/output/
__init__
.py to import your plugin in the correct alphabetical order.